Automaticly getting the IP of a Virus Sender?

[Alex Neuman]

Vispan does something similar to this at the MTA level.
http://www.while.homeunix.net/mailstats/ is where you'll find it. You could
probably modify the script to do what you need.

-----Original Message-----
From: MailScanner mailing list [mailto:MAILSCANNER at JISCMAIL.AC.UK] On Behalf
Of Karl M. Joch
Sent: Tuesday, June 15, 2004 4:30 AM
To: MAILSCANNER at JISCMAIL.AC.UK
Subject: Automaticly getting the IP of a Virus Sender?

Hello,

I was looking to add a script to automaticly block IPs of Virus senders
in the firewall. Is there any way to run a script when finding a Virus,
or Spam, getting the sender IP in a variable? All of our servers updates
the firewall from a central point and the blocks are removed every
night. This would help against mass mail viruses alot. I know this can
be dangerous when blocking some ISPs mail server but maybe this helps
that some ISPs blocks some traffic at their servers too. Finally the ISP
mail server will retry to send the emails for a loger time, but mails
from a workstation having a virus are mostly sent direct and not queued
somewhere which will bring the traffic and the system load for virus
scanning down.

--
Best regards / Mit freundlichen Gruessen,

Karl M. Joch

Unsere Services:
http://www.ctseuro.com - Netzwerk und Sicherheitstechnik
http://www.eushop.net - ASP:Onlineshop und Applikationen einfach mieten
http://www.freebsd.at - Das Power Betriebssystem
http://www.mydynip.org - Dynamischer DNS Service - jetzt IPv6 Support

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html

-------------------------- MailScanner list ----------------------
To leave, send    leave mailscanner    to jiscmail at jiscmail.ac.uk
Before posting, please see the Most Asked Questions at
http://www.mailscanner.biz/maq/     and the archives at
http://www.jiscmail.ac.uk/lists/mailscanner.html